Merge pull request #36 from leapcode/feature/limit_user_leak

When attempting to login, the error messages should not leak information...

1 files changed, 2 insertions, 2 deletions

diff --git a/users/test/integration/api/account_flow_test.rb b/users/test/integration/api/account_flow_test.rb
index 314d71a..e618541 100644
--- a/users/test/integration/api/account_flow_test.rb
+++ b/users/test/integration/api/account_flow_test.rb
@@ -75,7 +75,7 @@ class AccountFlowTest < ActiveSupport::TestCase
   test "signup and wrong password login attempt" do
     srp = SRP::Client.new @login, :password => "wrong password"
     server_auth = srp.authenticate(self)
-    assert_json_error :password => "wrong password"
+    assert_json_error({:login => "Not a valid username/password combination", :password => "Not a valid username/password combination"})
     assert !last_response.successful?
     assert_nil server_auth["M2"]
   end
@@ -86,7 +86,7 @@ class AccountFlowTest < ActiveSupport::TestCase
     assert_raises RECORD_NOT_FOUND do
       server_auth = srp.authenticate(self)
     end
-    assert_json_error :login => "could not be found"
+    assert_json_error({:login => "Not a valid username/password combination", :password => "Not a valid username/password combination"})
     assert !last_response.successful?
     assert_nil server_auth
   end